From eb186c415253f4c4bc302e870818e23728c9a817 Mon Sep 17 00:00:00 2001
From: bitwhisker <bitwhisker@noreply.git.hamburg.ccc.de>
Date: Sun, 21 Jun 2026 20:13:29 +0200
Subject: [PATCH] unbound(role): fix unbound prometheus exporter install on
 debian

- download debian image from github und verify checksum
- setup systemd service unit
---
 .../files/prometheus-unbound-exporter.service | 12 +++++
 roles/unbound/tasks/main.yml                  | 14 ++---
 roles/unbound/tasks/prometheus-exporter.yml   | 52 ++++++++++++++++---
 3 files changed, 65 insertions(+), 13 deletions(-)
 create mode 100644 roles/unbound/files/prometheus-unbound-exporter.service

diff --git a/roles/unbound/files/prometheus-unbound-exporter.service b/roles/unbound/files/prometheus-unbound-exporter.service
new file mode 100644
index 0000000..d3b4c9f
--- /dev/null
+++ b/roles/unbound/files/prometheus-unbound-exporter.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=Prometheus exporter for Unbound metrics, written in Go with pluggable metric collectors. The metrics exporter converts Unbound metric names to Prometheus metric names and labels by using a set of regular expressions.
+Documentation=https://github.com/letsencrypt/unbound_exporter
+After=network.target
+
+[Service]
+Type=simple
+EnvironmentFile=/etc/prometheus-unbound-exporter.conf
+ExecStart=/bin/unbound_exporter ${UNBOUND_EXPORTER_ARGS}
+
+[Install]
+WantedBy=multi-user.target
diff --git a/roles/unbound/tasks/main.yml b/roles/unbound/tasks/main.yml
index 2cf2261..69b712f 100644
--- a/roles/unbound/tasks/main.yml
+++ b/roles/unbound/tasks/main.yml
@@ -31,13 +31,6 @@
         group: unbound
         mode: u=rw,g=r,o=r
 
-    - name: ensure unbound is running and enabled
-      become: true
-      ansible.builtin.systemd:
-        name: unbound.service
-        state: started
-        enabled: true
-
     - name: disable systemd-resolved
       when: unbound_disable_systemd_networkd
       ansible.builtin.include_role:
@@ -47,6 +40,13 @@
         deploy_systemd_resolved_config__dns:
           - 127.0.0.1
 
+    - name: ensure unbound is running and enabled
+      become: true
+      ansible.builtin.systemd:
+        name: unbound.service
+        state: started
+        enabled: true
+
     - name: install and configure prometheus-exporter for unbound
       ansible.builtin.import_tasks: prometheus-exporter.yml
       when: unbound_install_prometheus_exporter
diff --git a/roles/unbound/tasks/prometheus-exporter.yml b/roles/unbound/tasks/prometheus-exporter.yml
index fba5090..bbf69e7 100644
--- a/roles/unbound/tasks/prometheus-exporter.yml
+++ b/roles/unbound/tasks/prometheus-exporter.yml
@@ -1,8 +1,48 @@
 ---
-- name: install unbound prometheus exporter # FIXME: there is no prometheus-unbound-exporter in debian .deb exists in https://github.com/letsencrypt/unbound_exporter/releases/tag/v0.6.0
+- name: install unbound prometheus exporter
   become: true
-  ansible.builtin.package:
-    name: prometheus-unbound-exporter
+  vars:
+    prometheus_unbound_exporter_version: "0.6.0"
+    prometheus_unbound_exporter_filename: "unbound_exporter-v{{ prometheus_unbound_exporter_version }}.x86_64.deb"
+    prometheus_unbound_exporter_github_api_url: "https://api.github.com/repos/letsencrypt/unbound_exporter/releases/tags/v{{ prometheus_unbound_exporter_version }}"
+  block:
+    - name: request github api
+      ansible.builtin.uri:
+        url: "{{ prometheus_unbound_exporter_github_api_url }}"
+        method: GET
+        body_format: json
+        headers:
+          'Accept': 'application/vnd.github+json'
+      register: unbound_exporter_github_api_result
+
+    - name: get prometheus-unbound-exporter download url and digest
+      ansible.builtin.set_fact:
+        unbound_exporter_download_url: "{{ unbound_exporter_github_api_result.json.assets[0].browser_download_url }}"
+        unbound_exporter_download_digest: "{{ unbound_exporter_github_api_result.json.assets[0].digest }}"
+
+    - name: Download prometheus-unbound-exporter deb package with verified checksum
+      ansible.builtin.get_url:
+        url: "{{ unbound_exporter_download_url }}"
+        dest: "/tmp/{{ prometheus_unbound_exporter_filename }}"
+        checksum: "{{ unbound_exporter_download_digest }}"
+        mode: "u=r,g=r,o=r"
+
+    - name: Install prometheus-unbound-exporter deb package
+      become: true
+      ansible.builtin.apt:
+        deb: "/tmp/{{ prometheus_unbound_exporter_filename }}"
+        state: present
+      notify: prometheus-unbound-exporter.restarted
+
+- name: deploy prometheus-unbound-exporter systemd service
+  become: true
+  ansible.builtin.copy:
+    src: "prometheus-unbound-exporter.service"
+    dest: "/etc/systemd/system/prometheus-unbound-exporter.service"
+    owner: root
+    group: root
+    mode: '0644'
+  notify: systemd-daemon-reload
 
 - name: enable unbound prometheus exporter
   become: true
@@ -14,10 +54,10 @@
 - name: configure unbound exporter
   become: true
   ansible.builtin.copy:
-    dest: /etc/conf.d/prometheus-unbound-exporter
+    dest: /etc/prometheus-unbound-exporter.conf
     content: |
-      UNBOUND_EXPORTER_ARGS="-unbound.ca "" -unbound.cert "" -unbound.host "unix:///run/unbound-control.sock"
+      UNBOUND_EXPORTER_ARGS="-unbound.ca "" -unbound.cert "" -unbound.host "unix:///run/unbound.ctl"
     owner: root
     group: root
-    mode: '0660'
+    mode: '0644'
   notify: prometheus-unbound-exporter.restarted